Spoofing: Hidden Outlook headers in self-addressed forwards

 1name: "Spoofing: Hidden Outlook headers in self-addressed forwards"
 2description: "Catches messages where the sender address is spoofed to match the recipient (failing DMARC), simulating a self-forwarded email. The HTML body contains a hidden (display:none) block mimicking Outlook-style forward/reply headers (From/Sent/Subject), used to disguise injected lure content such as fake remittance receipts or finance document notifications. An NLU classifier confirms the thread content carries malicious intent rather than benign forwarding."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  // self sender
 8  and (
 9    sender.email.email == recipients.to[0].email.email
10    and not coalesce(headers.auth_summary.dmarc.pass, false)
11  )
12  // a hidden quoted reply header... we can use translate() lowercases
13  // and strip spaces so `DISPLAY:NONE` or `display: none` would both match
14  // https://developer.mozilla.org/en-US/docs/Web/XML/XPath/Reference/Functions/translate
15  and any(html.xpath(body.html,
16                     '//*[contains(translate(@style, "ABCDEFGHIJKLMNOPQRSTUVWXYZ ", "abcdefghijklmnopqrstuvwxyz"), "display:none")]'
17          ).nodes,
18          // outlook-style headers... long to/cc lists can sit between sent and subject
19          regex.icontains(.raw, 'From:.{0,1000}Sent:.{0,1000}Subject:')
20  )
21  and any(ml.nlu_classifier(body.current_thread.text).intents, .name != 'benign')  
22attack_types:
23  - "BEC/Fraud"
24  - "Credential Phishing"
25tactics_and_techniques:
26  - "Spoofing"
27  - "Evasion"
28  - "Impersonation: Employee"
29  - "Social engineering"
30detection_methods:
31  - "Header analysis"
32  - "HTML analysis"
33  - "XML analysis"
34  - "Sender analysis"
35  - "Natural Language Understanding"
36id: "2560b979-c51f-5469-b78f-4a347e8db470"